Cross-Site Request Forgery in WP Affiliate Platform Plugin for WordPress
CVE-2022-3898

8.8HIGH

Key Information:

Vendor
Wordpress
Status
WP Affiliate Platform
Vendor
CVE Published:
29 November 2022

Summary

The WP Affiliate Platform plugin for WordPress exhibits a Cross-Site Request Forgery vulnerability due to improper nonce validation in several functions, notably in the affiliates_menu method. This flaw permits unauthenticated attackers to execute unauthorized actions, such as deleting affiliate records, by exploiting a trust relationship to deceive an administrator into inadvertently triggering a malicious request.

Affected Version(s)

WP Affiliate Platform * <= 6.3.9

References

https://www.tipsandtricks-hq.com/wordpress-affiliate-plat...
https://www.wordfence.com/vulnerability-advisories-contin...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Wotschka
.